<html>
<head><meta charset="utf-8"><title>mixing panic/unwind · project-ffi-unwind · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/index.html">project-ffi-unwind</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html">mixing panic/unwind</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="244491152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244491152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Crichton <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244491152">(Jun 30 2021 at 21:32)</a>:</h4>
<p>hm ok I just realized a much more fundamental issue. We allow mixing <code>-Cpanic=unwind</code> and <code>-Cpanic=abort</code> crates so long as the final panic runtime is <code>-Cpanic=abort</code>. This is what enables us to ship a standard library compiled with <code>-Cpanic=unwind</code> but you can use that to compile and link with <code>-Cpanic=abort</code>. This support, however, can lead to theoretical UB:</p>
<ul>
<li>Compile crate A with <code>-Cpanic=unwind</code>. This crate has a Rust function <code>foo</code> that calls a C++ function with the <code>C-unwind</code> ABI</li>
<li>Compile crate B with <code>-Cpanic=abort</code>. This crate calls <code>A::foo()</code>. The function that calls <code>A::foo</code> is tagged as <code>nounwind</code> but it does in fact unwind because nothing inject a landing pad or similar to catch exceptions and abort. This is a Rust-&gt;Rust function call, and because the crates are compiled differently we the answer of "can this function unwind" will change</li>
</ul>
<p>I think the only fix for this is to forbid mixing <code>-Cpanic=abort</code> and <code>-Cpanic=unwind</code>.</p>



<a name="244491379"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244491379" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Crichton <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244491379">(Jun 30 2021 at 21:35)</a>:</h4>
<p>(updated the above message since I sent the first version too soon)</p>



<a name="244491554"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244491554" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244491554">(Jun 30 2021 at 21:36)</a>:</h4>
<p>The eh_personality of panic_abort aborts even when it is used by a panic=unwind crate AFAIK, so the moment an exception enters rust code, the process aborts.</p>



<a name="244491655"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244491655" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244491655">(Jun 30 2021 at 21:37)</a>:</h4>
<p>looks like it doesn't: <a href="https://github.com/rust-lang/rust/blob/868c702d0c9a471a28fb55f0148eb1e3e8b1dcc5/library/panic_abort/src/lib.rs#L121">https://github.com/rust-lang/rust/blob/868c702d0c9a471a28fb55f0148eb1e3e8b1dcc5/library/panic_abort/src/lib.rs#L121</a></p>



<a name="244491719"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244491719" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244491719">(Jun 30 2021 at 21:38)</a>:</h4>
<p>making it abort too, should fix this soundness issue.</p>



<a name="244504494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244504494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244504494">(Jul 01 2021 at 00:10)</a>:</h4>
<p>Certainly we want the process to abort in that case if the C++ function does in fact throw an exception.</p>



<a name="244504522"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244504522" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244504522">(Jul 01 2021 at 00:11)</a>:</h4>
<p>(just to make sure everyone is on the same page w/ the desired behavior)</p>



<a name="244504647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244504647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244504647">(Jul 01 2021 at 00:13)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/210922-project-ffi-unwind/topic/next.20steps/near/244491655">said</a>:</p>
<blockquote>
<p>looks like it doesn't: <a href="https://github.com/rust-lang/rust/blob/868c702d0c9a471a28fb55f0148eb1e3e8b1dcc5/library/panic_abort/src/lib.rs#L121">https://github.com/rust-lang/rust/blob/868c702d0c9a471a28fb55f0148eb1e3e8b1dcc5/library/panic_abort/src/lib.rs#L121</a></p>
</blockquote>
<p>I don't fully understand the linking behavior here; are you saying that this function <em>would</em> get called in this case?</p>



<a name="244504738"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244504738" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244504738">(Jul 01 2021 at 00:14)</a>:</h4>
<p>But I agree that if we can get a function that aborts linked as the <code>eh_personality</code> function in the mixed-panic-mode case, that should result in the desired behavior.</p>



<a name="244525001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244525001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244525001">(Jul 01 2021 at 06:46)</a>:</h4>
<p>When using -Cpanic=abort, you will link against the panic_abort crate and thus use it's eh_personality.</p>



<a name="244541450"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244541450" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244541450">(Jul 01 2021 at 09:46)</a>:</h4>
<blockquote>
<p>This is a Rust-&gt;Rust function call, and because the crates are compiled differently we the answer of "can this function unwind" will change</p>
</blockquote>
<p>Couldn't it be the case that the answer to "can this unwind" depends on the crate the fn is defined in?</p>



<a name="244541563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244541563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244541563">(Jul 01 2021 at 09:47)</a>:</h4>
<p>we presumably already store the panic runtime in the crate metadata. so <code>can_unwind</code> should look up the runtime of the crate the function is in. then that Rust-&gt;Rust call you mention will be recognized as an "unwinding call in a non-unwinding crate", right?</p>



<a name="244541642"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244541642" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244541642">(Jul 01 2021 at 09:48)</a>:</h4>
<p>(though that might be a notable perf hit for panic=abort code as now it needs landing pads for libstd calls... unless we have some analysis that shows they are all not needed)</p>



<a name="244594484"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244594484" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244594484">(Jul 01 2021 at 16:39)</a>:</h4>
<p>Aborting in the <code>eh_personality</code> of <code>libpanic_abort</code> should be enough to fix this soundness issue. It is also much easier to implement.</p>



<a name="244599972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244599972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244599972">(Jul 01 2021 at 17:21)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/210922-project-ffi-unwind/topic/next.20steps/near/244541642">said</a>:</p>
<blockquote>
<p>(though that might be a notable perf hit for panic=abort code as now it needs landing pads for libstd calls... unless we have some analysis that shows they are all not needed)</p>
</blockquote>
<p>I believe <span class="user-mention" data-user-id="116009">@nikomatsakis</span> did do some profiling around this a year or two ago, but unfortunately I don't remember it being very conclusive; and, also unfortunately, I think this de-optimization for <code>panic=abort</code> was considered something of a nonstarter during previous discussions.</p>



<a name="244677532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/mixing%20panic/unwind/near/244677532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/mixing.20panic.2Funwind.html#244677532">(Jul 02 2021 at 09:16)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/210922-project-ffi-unwind/topic/next.20steps/near/244594484">said</a>:</p>
<blockquote>
<p>Aborting in the <code>eh_personality</code> of <code>libpanic_abort</code> should be enough to fix this soundness issue. It is also much easier to implement.</p>
</blockquote>
<p>Opened <a href="https://github.com/rust-lang/rust/pull/86801">https://github.com/rust-lang/rust/pull/86801</a></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>